Verifying Videos and Images

Aric Toler, Bellingcat

1) Key questions in video/image verificationa) Where?b) When?c) Who?d) Why?

2) Metadata and digital forensics3) Think like a faker

Key questions in image/video verification:

1) Where?

Determine through geolocation

2) When?

Determine (if possible) through shadows, weather, temporary details, context

3) Who?

Determining first -- not most popular -- source

4) Why?

Determine motive

Geolocation: Where was a photograph/video shot?

Determine the location of a photograph or video by finding identifiable features in a photographic/video, then match them to the same features in another photograph/video or satellite image.

Geolocation: Where was a photograph/video shot?

Determine the location of a photograph or video by finding identifiable features in a photographic/video, then match them to the same features in another photograph/video or satellite image.

Source Material from YouTube, social media, etc...

Geolocation: Where was a photograph/video shot?

Determine the location of a photograph or video by finding identifiable features in a photographic/video, then match them to the same features in another photograph/video or satellite image.

Source Material from YouTube, social media, etc...

Cross-reference materials for geolocation

Source material Google Street View

Street-Level Imagery● Google Street View (All over!)● Bing Streetside (US, UK, France, Spain)● Yandex Panorama (Russia/Former Soviet Union)● MapJack (West Coast US, Sweden, Thailand...)● Some countries and cities have specialized

services

Source material Satellite imagery

Source material Satellite imagery

Source material Satellite imagery

Source material Satellite imagery

Source material Satellite imagery

(Free) Satellite Imagery● Google Earth (historical imagery available)● Google Maps (no historical imagery)● Yandex Maps● Bing Maps● Wikimapia (combines multiple services)● Terraserver (only previews are free)

Source material Other Photo/Video

Geotagged Photos/Videos● Google Earth (turn on “photos” option)● Panoramio (shutting down soon, integrated into

Google Earth)● Yandex Maps (geotagged photos included)● Echosec ($$$, shows geotagged

Instagram/VK/Twitter posts)● YouTube (search street names for dash cams)

5-Minute Verification

Reverse Image Search

No results

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Why geolocate?The International Criminal Court (ICC) issued an arrest warrant for a Libyan commander for unlawful executions and war crimes. This warrant was issued entirely based off of evidence from social media.

Not only does geolocating a video verify that the events really took place, it also solidifies evidence that can be used in criminal investigations. The ICC was not able to geolocate this video on their own, but a crowdsourcing campaign ran by Bellingcat provided coordinates for the video -- proving that it really did take place. The video was filmed at a military compound controlled by this Libyan commander, in between Benghazi and its airport.

“Temporal Location” When was a photograph/video shot?

Determine the date/general time of a photograph or video by finding time-specific details, such as weather or temporary features (e.g. billboards), or determine a more precise time* by analyzing visible shadows.

Will likely not give you 100% verification, but will let you quickly sniff out fakes.

*Exact location and approximate date needed

Temporary Details

Temporary Details

Temporary Details

Temporary Details

Temporary Details

Supposed eye witness to arrest of Manhattan / New Jersey bombing suspect -- other than geolocation, how do we verify that this image could be real?

Arrested on September 19, 2016

Digital SundialsUsing shadows to determine a specific time

If you know exactly where a photograph or video was taken, the approximate date, and there are clear shadows visible, you can often determine the approximate time of the source material.

Use Suncalc.org to place the shadow visible in photograph/video, and then adjust to match source material.

Don’t forget to adjust for time zones!

Reported skirmish between Indian and Chinese soldiers at a lake.

Alleged time: August 15, 7:30am

Shadows seem to be perpendicular to the shore, visible paths

Who and Why?

We have a smaller digital toolset to establish who took a photograph or video, and why they did it.

Who and Why?

We have a smaller digital toolset to establish who took a photograph or video, and why they did it.

You can make some basic digital efforts, such as finding the social media profiles of the supposed author of a photograph/video, and then following up on potential motivations.

Who and Why?

We have a smaller digital toolset to establish who took a photograph or video, and why they did it.

You can make some basic digital efforts, such as finding the social media profiles of the supposed author of a photograph/video, and then following up on potential motivations.

While verification is important, it is also vital to figure out the real author of photographs or videos - especially with the rise of licensing services for viral photographs and videos from social media (Storyful, Viralhog, Jukin Media, etc.)

Metadata and Digital Forensics

Some interesting capabilities, but ultimately limited

Metadata can be useful for verifying photographs and videos straight from a device, but this metadata is lost when files are shared or sent through social networks or messaging applications.

If you want to receive a photograph and retain metadata, have it sent directly via email or MMS -- not Facebook chat, Telegram, Twitter, etc.

Photo sent via Facebook (left)

vs.

Photo taken directly from phone (right)

imageedited.com

Limits of naked-eye analysisWe may think we are good at finding fake photographs, but often we come up short. Also, freely available, easy-to-use digital analysis is difficult to come by.

Think Like a Faker

Creative verification to win the fake news arms race

How to root out the fake?● Think like a faker -- how would you find the source material to spread a fake

photograph or video?

How to root out the fake?● Think like a faker -- how would you find the source material to spread a fake

photograph or video?● Search Google (videos or images) with general terms that match the possibly

fake video, then search through results for something that looks familiar.

How to root out the fake?● Think like a faker -- how would you find the source material to spread a fake

photograph or video?● Search Google (videos or images) with general terms that match the possibly

fake video, then search through results for something that looks familiar.● Most fakers find source material without clear, identifiable features

contradicting the supposed setting, such as street signs, landmarks, etc.

How to root out the fake?● Think like a faker -- how would you find the source material to spread a fake

photograph or video?● Search Google (videos or images) with general terms that match the possibly

fake video, then search through results for something that looks familiar.● Most fakers find source material without clear, identifiable features

contradicting the supposed setting, such as street signs, landmarks, etc.● Be aware of filters, alterations, or added “noise” to make a photograph or

video harder to trace back.

How to root out the fake?● Think like a faker -- how would you find the source material to spread a fake

photograph or video?● Search Google (videos or images) with general terms that match the possibly

fake video, then search through results for something that looks familiar.● Most fakers find source material without clear, identifiable features

contradicting the supposed setting, such as street signs, landmarks, etc.● Be aware of filters, alterations, or added “noise” to make a photograph or

video harder to trace back. ○ Zooming in on photograph/video○ Mirroring○ Extra logos/graphics in corners, obscuring details○ Dubbed-in or removed audio (in order to add authenticity, or strip speech/languages)

● Photo shared on social media page of “Russian soldier” claiming to have shot down Malaysian Airlines Flight 17 (MH17)

● Profile seemed legitimate -- friends, photos, apparently from real division in Russian military

● Shared geotagged photo of missile system in Donetsk, Ukraine

● Photo did not have any results on Google Image Search, suggesting it was original (thus, not borrowed/recycled from another source)

It is not only fake “soldiers” altering images to pass them off as real. A Brazilian man named “Eduardo Martins” passed off the real photos of professional photographers as his own, after doing slight modifications to them, preventing results on reverse image searches. His photos were published on Getty, Deutsche Welle, Wall Street Journal, and other prestigious publications and photo services.